Agent skills for Gemini CLI

Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,

Analyzes malicious VBA macros embedded in Microsoft Office documents

URLScan.io is a free service for scanning and analyzing suspicious URLs.

Detonate malware samples in Cuckoo Sandbox to observe runtime behavior

Query the Malpedia API to look up malware family aliases and naming

Use Sysinternals Autoruns to systematically enumerate and analyze malware

Detect sandbox and VM evasion techniques in malware samples by analyzing

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,

Performs Linux memory acquisition using LiME (Linux Memory Extractor)

Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,

Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port

Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous…

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including

Analyzes network traffic generated by malware during sandbox execution

Captures and analyzes network packet data using Wireshark and tshark

Calculate NFT rarity scores and rank tokens by trait uniqueness.

Process perform on-chain analysis including whale tracking, token flows,

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and…

Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated…

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications…

Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group…